diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index e256972fee..68353e909a 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -970,8 +970,11 @@ acl_mask(
 		}
 	}
 
+	/* implicit "by * none" clause */
+	ACL_INIT(*mask);
+
 #ifdef NEW_LOGGING
-	LDAP_LOG(( "aci", LDAP_LEVEL_RESULTS,
+	LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 		   "acl_mask: conn %d  no more <who> clauses, returning %d (stop)\n",
 		   conn->c_connid, accessmask2str( *mask, accessmaskbuf) ));
 #else